A vulnerability location method based on assembly language and deep learning

Abstract

This paper proposes a high-precision vulnerability localization method based on assembly language and deep learning, which achieves high vulnerability detection capabilities and high localization accuracy. First, a C language program is compiled and disassembled to obtain assembly code containing address information. Then, addr2line is used to generate a mapping between assembly code and source code line numbers. The assembly code is then segmented into function units to obtain code blocks, which are encoded into vectors and used as input for a neural network model. Finally, a BILSTM-LOC model is proposed to learn vulnerability characteristics and predict vulnerability locations. Experimental results show that this method outperforms state-of-the-art vulnerability detection methods in both existing datasets and real-world software product vulnerability detection.

Description

Technical Field

[0001] The present invention relates to the field of network security, and more particularly to a method for locating vulnerabilities in C language source code. Background Art

[0002] With the advancement of computer technology, network security has become an unavoidable issue on the internet. Vulnerabilities are an unavoidable aspect of network security. A vulnerability refers to a flaw in a computer application or system that, once exploited by hackers, can cause irreparable damage and consequences. While the increasing number of software applications being developed today allows people to enjoy their daily lives, they can also harbor significant security risks. For example, in the early stages of software development, engineers and developers can create serious vulnerabilities due to errors or oversights in source code compilation. Exploiting these vulnerabilities can cause significant financial losses. By this time, the software has already been released, and re-releasing the software would require significant manpower and resources. Therefore, to prevent such vulnerabilities from occurring, vulnerability detection in the early stages of software development (i.e., based on the source code) is crucial. According to statistics, the U.S. National Vulnerability Database (NVD) published over 19,537 vulnerabilities in 2021. Despite the diligent research and discovery of these vulnerabilities by numerous experts and scholars, the situation remains uncertain as software requirements and code complexity increase exponentially. Therefore, developing a vulnerability detection method with a low false negative rate and high localization accuracy is crucial.

[0003] Currently, mainstream vulnerability detection methods are categorized as static analysis, dynamic analysis, and machine learning-based vulnerability detection. Static analysis methods do not require program execution during code analysis, but they suffer from a high false negative rate. Dynamic analysis methods, which can be divided into fuzz testing and taint analysis, offer improved detection accuracy compared to static analysis methods, but consume more resources and are relatively inefficient. To address these issues, machine learning (particularly deep learning) has been gradually applied to vulnerability detection. Its ability to automatically learn vulnerability signatures simplifies the vulnerability detection process and significantly improves both accuracy and speed. For example, Liu et al. encoded code into binary files, extracted binary functions using IDAPro, and then utilized a bidirectional long short-term memory model to learn and predict vulnerabilities. Li et al. converted source code into a minimum intermediate representation (MIR). By pre-training on a generated corpus, these intermediate representations were converted into vectors and fed into three convolutional neural networks to learn vulnerability signatures for vulnerability classification. Laura et al. encoded code into vectors using the Word2Vec model and then constructed an LSTM network to perform fine-grained classification of vulnerable token sequences, predicting specific regions of the source code that may contain vulnerabilities. Li et al. proposed SySeVR, which first defines four vulnerability grammatical features and generates code slices related to vulnerable statements through control flow and data flow. They then use the BGRU model to detect vulnerabilities at the slice level. Yan et al. proposed a hierarchical attention network, HAN-BSVD, for binary software vulnerability detection. This network enriches contextual information using a preprocessor that unifies jump addresses and normalizes instructions. It then uses an instruction embedding network composed of Bi-GRU and word attention modules to preserve contextual information. Finally, a feature extraction network composed of Text-CNN and spatial attention modules captures local features. Traditional vulnerability detection methods rely on experts to develop corresponding vulnerability rules, which is not only time-consuming and labor-intensive but also prone to significant errors. Their specialized nature also carries a high learning cost and difficulty in use, hindering their widespread adoption and democratization. All of the methods discussed above suffer from several critical flaws, including an inability to accurately locate vulnerabilities, high rates of false positives and false negatives, and a high learning cost that makes them inconvenient for others to use. Summary of the Invention

[0004] Automatic detection of software vulnerabilities is a critical issue in network security. While currently proposed deep learning-based methods are effective in detecting vulnerabilities, their lack of accuracy and inability to accurately locate vulnerabilities significantly limit their practical use. To address these issues, this paper proposes a high-precision vulnerability localization method based on assembly language and deep learning.

[0005] The technical solution adopted in the present invention is:

[0006] A vulnerability location method based on assembly language and deep learning, mainly including the following steps:

[0007] Step A: compile the source code into target code, use GDB to disassemble the target code, obtain the assembly code containing address information, and further obtain the assembly code containing source code line numbers, then obtain all debuggable functions in the target code, slice each complete assembly code in units of functions, and obtain multiple code blocks, where the source code includes all training samples and test samples;

[0008] Step B: Mark the code block: query the description file provided by the training sample dataset. If the code block contains a known vulnerability, mark it as 1, otherwise mark it as 0;

[0009] Step C: Encode the training sample code block into a vector and input it into the established neural network model for training. The neural network model is a BILSTM-LOC model, which includes an input layer, a standard BILSTM layer, and a positioning layer;

[0010] In step D, the trained BILSTM-LOC model is used to detect and locate vulnerabilities in test samples during the testing phase.

[0011] Furthermore, the specific implementation method of obtaining the assembly code containing the source code line number in step A is as follows;

[0012] Step A1: compile all source codes, i.e., all training samples and test samples into target codes through GCC, and select all successfully compiled programs;

[0013] Step A2, disassembly, uses the GDB tool to debug the target code to obtain the assembly code with the address, and uses the Addr2line tool to convert the address into the line number of the source code, thereby obtaining the assembly code including the line number of the source code.

[0014] Furthermore, each code block in step A consists of two parts: assembly instructions and source code line numbers corresponding to each line of assembly instructions, and each line of assembly instructions consists of multiple tokens.

[0015] Furthermore, the specific structure of the BILSTM-LOC model in step C is as follows;

[0016] Step C1, input layer: Before inputting into the neural network model, each labeled code block is encoded into a vector and then the vector length is unified. The length of the vector input to the neural network is set to δ, where δ is the length of the code block. If the vector length is less than δ, it is padded with 0 at the end. If the vector length is greater than δ, the part greater than δ is trimmed from the end. Each token is encoded as a vector of length θ and each code block is encoded as a vector of length "δ×θ×β", where θ is the length of the vector obtained after encoding each token and β represents the maximum number of assembly instructions per line.

[0017] Step C2, Standard BILSTM Layer: The encoded fixed-length vector is input into the standard BILSTM layer for learning vulnerability features. The standard BILSTM layer consists of two standard BILSTM layers, a dropout layer, a fully connected layer, and an activation layer. The dropout layer is used to prevent overfitting of the neural network, while the fully connected layer and activation layer are used to obtain prediction results.

[0018] Step C3, positioning layer: The output of BILSTM corresponding to a batch-sized code block of input is expressed as:

[0019] y=[γ1 β2 … γ μ-1 γ μ ] T (1)

[0020] The value range of μ is 1≤μ≤batchsize, where batchsize represents the batch size; γ μ Expressed as:

[0021]

[0022] Refers to the output corresponding to each line of assembly instructions in a code block, and δ represents the length of the code block. To make nodes with vulnerabilities receive more attention, the output of BILSTM is multiplied by the 01Matrix, denoted as M, which is used to retain the information of nodes with vulnerabilities while removing the information of nodes not related to the vulnerability. M can be expressed as:

[0023]

[0024] where m μ,δ Calculate according to the following principle: The source code line number corresponding to the known code block is represented as a set Cb μ ={l1,l2…l n}, 1≤n≤δ, δ represents the length of the code block; the real vulnerability line number is known to be v, for the code block with the vulnerability l n =v, let m μn =1, otherwise set mμn =0; for code blocks without vulnerabilities, set m μn =1;

[0025] After obtaining the matrix M, it is multiplied by the output of BILSTM. Then, the K-max pooling layer is used to select the top k largest values of the output corresponding to each code block, that is, the top k most important information predicted by the neural network. These k largest values are input into the global average pooling layer to calculate the average value and obtain the output ω, which is defined as:

[0026] ω=Average(Max k (γ μ M))=(t1,t2…t μ-1 ,t μ ) (4)

[0027] Function Max k Calculate the k maximum values of the predicted value, and the function Average is used to calculate the average of the k maximum values, t μ Indicates the output corresponding to each code block.

[0028] Furthermore, the specific implementation of step D is as follows:

[0029] Step D1: Encode the code blocks in the test set into vectors. Each code block is encoded as a vector of length δ×θ×β.

[0030] Step D2: The vector obtained after encoding each code block is input into the trained BILSTM-LOC model to obtain the output of each line of assembly code. First, the k maximum values of the output are calculated, and then the average of the k maximum values is calculated. If the average value is greater than the threshold σ, the code block with the vulnerability and the assembly code corresponding to its k maximum values are output. The line number before the assembly code is mapped to the line of the source code, and finally the vulnerable line number of the source code is obtained.

[0031] Step D3: The output value corresponding to each line of assembly code ranges from 0 to 1.0. The closer the output is to 1.0, the higher the possibility that there is a vulnerability in the line of assembly code.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] The present invention provides a vulnerability location method based on assembly language and deep learning. Unlike most current mainstream vulnerability detection tools, which only predict vulnerabilities at the function level or code slice level, the present invention accurately detects vulnerabilities at the code line level, greatly reducing the granularity of vulnerability detection. The essence of regression vulnerability detection is that this method takes the C program source code to be detected as input and the line number of the vulnerability as output. In standard data sets, the present invention achieves higher detection capabilities and location accuracy compared to other methods. In daily work, it can assist software developers in quickly locating vulnerabilities to facilitate subsequent patching work. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is the overall framework diagram of the vulnerability localization method based on assembly language and deep learning provided by the present invention.

[0035] Figure 2 This is an example of converting a vulnerable C source code into code blocks.

[0036] Figure 3 This is the architecture diagram of the BILSTM-LOC model proposed in this invention.

[0037] Figure 4 A diagram showing the process of vulnerability location in the present invention.

[0038] Figure 5 An example of the model output.

[0039] Figure 6 This is the vulnerability detection result and positioning result diagram of the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the accompanying drawings in the present invention to clearly and completely describe the technical solution. Obviously, the embodiments described are only part of the embodiments of the present invention and are only used for illustrative purposes and should not be understood as limitations of this patent. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0041] The present invention will be further described below with reference to the accompanying drawings.

[0042] 1. Data preprocessing (processing source code into assembly code blocks).

[0043] Step 1-1: In order for the neural network to be able to predict vulnerability locations, the input data must contain vulnerability location information (i.e., line numbers). Therefore, it is necessary to construct assembly code containing source code line numbers. Generating assembly code containing source code line numbers can be divided into the following two steps: compilation and disassembly. (i) Compile all C language programs (i.e., source code, including all training samples and test samples) into target code using GCC. (ii) Use the GDB tool to debug the target code to obtain assembly code with addresses. At the same time, use Addr2line to convert the addresses into source code line numbers, thereby obtaining assembly code containing source code line numbers. Figure 2 (a) shows an example of a vulnerable C program. Figure 2 (b) Process it into an assembly code structure with addresses.

[0044] Step 1-2: If a complete assembly code is used directly as a vulnerability detection target, the neural network will learn too many features unrelated to the vulnerability, resulting in a high false negative rate. Therefore, the complete assembly code is sliced to obtain assembly code blocks based on source code functions. Use GDB to obtain all debuggable functions in the target code (that is, all custom functions excluding library functions), and then slice each complete assembly code by function, obtaining multiple code blocks. Figure 2 (c) shows the assembly code blocks obtained after slicing and line mapping. It can be seen that each code block consists of two parts: the assembly instructions and the source code line number corresponding to each line of assembly instructions. Each line of assembly instructions consists of multiple tokens. For example, there is a line of assembly instructions "movq$0x0,-0x70(%rbp)", then this line of assembly instructions has the following 7 tokens: "movq", "$0x0", ",", "-0x70", "(", "%rbp", ")".

[0045] 2. Mark the code block.

[0046] Since the present invention belongs to the category of supervised learning, it is necessary to label the input data. Source code vulnerability detection can be divided into a two-classification process, and the code blocks can be labeled according to the following principles: query the description file (i.e., .XML file) provided by the dataset, and if the code block contains a known vulnerability, mark it as 1, otherwise mark it as 0. Assume that the set of source code line numbers corresponding to each line of assembly code in a code block is represented by Cb = {l1,l2…l n}, let v be the real vulnerability line of the source code, if v∈Cb, mark this code block as 1, otherwise mark it as 0. Take the first 80% of the dataset as training data and 20% as test data.

[0047] 3. Build a neural network model (BILSTM-LOC).

[0048] like Figure 3 As shown in the figure, the construction of the BILSTM-LOC model can be roughly divided into the following three steps:

[0049] Step 3-1: Input layer. Before being input into the neural network model, each labeled code block is encoded into a vector. Suppose there is a line of assembly instructions "movq$0x0,-0x70(%rbp)", according to the commonly used word segmentation method in (Natural Language Processing, NLP), the assembly instruction is processed into "movq", "$0x0", ",", "-0x70", "(", "%rbp", ")", and the same method is used to perform the above operations for each code block. Finally, it is expanded into the corpus and uniformly encoded into vectors. The length of the vector obtained after encoding each code block is inconsistent. The neural network requires a fixed-length vector as input, so the vector length needs to be unified. Assume that the length of the vector input to the neural network is δ (that is, the length of the code block, which refers to how many lines of assembly instructions each code block has, which is Figure 3 If the vector length is less than δ, 0 is added to the end. If the vector length is greater than δ, the part greater than δ is trimmed from the end. In the present invention, assuming that each line of assembly instructions contains β tokens, θ is the length of the vector obtained after encoding each token, then each token is encoded as a vector of length θ and each code block is encoded as a vector of length "δ×θ×β", where β represents the maximum number of assembly instructions per line (i.e. Figure 3 in the Max sequence).

[0050] Step 3-2: BILSTM layer. The encoded fixed-length vector is input into this layer for learning vulnerability features. This layer consists of two standard BILSTM layers, a dropout layer, a fully connected layer, and an activation layer. The dropout layer is used to prevent overfitting of the neural network, while the fully connected layer and activation layer are used to obtain prediction results.

[0051] Step 3-3: Localization layer. The purpose of adding the localization layer is as follows: (i) The standard BILSTM model will learn many features that are not related to vulnerabilities because it treats every node equally. However, in the real vulnerability detection process, the code with vulnerabilities (nodes in the neural network) should receive more attention from the neural network, that is, the vulnerable code nodes should be assigned a larger weight. (ii) At the same time, in order to reduce the granularity of the detection results, the vulnerability detection results are refined to the code line level, removing features that are not related to the vulnerability (learning vulnerability-related features) and reducing the output granularity (predicting the vulnerability location). The output of the BILSTM corresponding to a batch-sized code block of input is expressed as:

[0052] y=[γ1 γ2 … γ μ-1 γ μ ] T (1)

[0053] The value range of μ is 1≤μ≤batchsize, where batchsize represents the batch size; γ μ Expressed as:

[0054]

[0055] Refers to the output corresponding to each line of assembly instructions in a code block, and δ represents the length of the code block; (i.e. Figure 3 In order to pay more attention to the nodes with vulnerabilities, the output of BILSTM is multiplied by the 01Matrix (denoted as M). This is used to retain the information of the nodes with vulnerabilities while removing the information of nodes that are not related to the vulnerabilities. M can be expressed as:

[0056]

[0057] where m μ,δ Calculate according to the following principle: The source code line number corresponding to the known code block is represented as a set Cb μ ={l1,l2…l n}(1≤n≤δ), δ represents the length of the code block; the real vulnerability line number is known to be v, for the code block with a vulnerability, if l n =v, let m μn =1, otherwise set m μn =0; for code blocks without vulnerabilities, set m μn =1.

[0058] After obtaining the matrix M, it is multiplied by the output of BILSTM. Then, the K-max pooling layer is used to select the top k largest values of the output corresponding to each code block (that is, the top k most important information predicted by the neural network). These k largest values are input into the global average pooling layer to calculate the average value and obtain the output ω, which is defined as:

[0059] ω=Average(Max k (γ μ M))=(t1,t2…t μ-1 ,t μ ) (4)

[0060] Function Max k Calculate the k maximum values of the predicted value, and the function Average is used to calculate the average of the k maximum values, t μ Indicates the output corresponding to each code block.

[0061] 4. Vulnerability detection.

[0062] Step 4-1: Similarly, encode the code blocks in the test set into vectors. Each code block is encoded as a vector of length δ × θ × β = 16000, where δ, θ, and β are 160, 10, and 10 respectively. This means that each line of assembly instructions contains 10 instructions and each token is encoded as a vector of length 10.

[0063] Step 4-2: The vector obtained after encoding each code block is input into the trained model (see Figure 4 ), get the output of each line of assembly code. First calculate the k maximum values of the output, and then find the average of the k maximum values. If the average value is greater than the threshold σ (set to 0.5), output the code block with the vulnerability and the assembly code corresponding to its k maximum values. Map the line number before the assembly code to the line of the source code, and finally get the vulnerable line number of the source code (such as Figure 4 in the Mapping layer).

[0064] Step 4-3: The output corresponding to each line of assembly code can be seen Figure 5 , its output value ranges from 0 to 1.0. The closer the output is to 1.0, the higher the possibility that there is a vulnerability in the assembly code line. Figure 5 The highlighted part indicates that the model predicts that the line of code with a vulnerability is line 6 of the source code to which this code block belongs.

[0065] Figure 6 The experimental results of the present invention are presented. Figure 6The left side of the figure shows the vulnerability localization results of the present invention. The horizontal axis of the graph shows the number of samples tested, and the vertical axis shows the number of rows with vulnerabilities. The graph contains two line segments: the predicted vulnerability row number and the actual vulnerability row number. It can be clearly understood that the greater the overlap between these two curves, the higher the vulnerability localization accuracy of the present invention. As can be seen in the figure, the two curves largely overlap, indicating that the present invention has high localization accuracy. Figure 6 The right side of the figure shows the ROC curve of the present invention. The horizontal axis of the figure is the false positive rate (FPR), the vertical axis is the true positive rate (TPR), and the area enclosed by the curve is the area under the curve (AUC). The closer the AUC is to 1.0, the better the detection method is. As can be seen from the figure, the AUC value of the present invention is 0.99, indicating high detection performance.

[0066] The following six indicators are used to evaluate the vulnerability detection capability of the present invention: False Positive Rate (FPR), False Negative Rate (FNR), Accuracy (Acc), Precision (Pr), Recall (Recall), and F1 value. Their calculation formulas are as follows.

[0067]

[0068]

[0069]

[0070]

[0071]

[0072]

[0073] Where TP represents the number of samples predicted to be vulnerable and actually have vulnerabilities, FP represents the number of samples predicted to be vulnerable but not actually have vulnerabilities, TN represents the number of samples predicted to be non-vulnerable and not actually have vulnerabilities, and FN represents the number of samples predicted to be non-vulnerable but actually have vulnerabilities. The vulnerability localization accuracy of the present invention is evaluated using the following two indicators: Average Distance (AD) and the number of vulnerability lines (VL) output. The calculation formula is as follows:

[0074]

[0075]

[0076] Where l1 represents the predicted vulnerability line number, l2 represents the actual vulnerability line number, n represents the total number of samples involved in the detection, and o i Represents the number of lines of vulnerability output. In actual vulnerability detection, the ideal result is that the predicted vulnerability line number matches the actual vulnerability line number (i.e., l1 = l2). Therefore, the closer AD approaches 0, the higher the vulnerability location accuracy. For the indicator VL, the closer its value is to 1, the more granular the vulnerability detection result is, meaning the detection result is a single line of code with a vulnerability, rather than multiple lines of code.

[0077] Table 1 shows the comparison results of the present invention with existing methods on a public dataset. It can be observed that in terms of vulnerability detection capabilities, the present invention improves FPR, FNR, Acc, and F1 by 2.8%, 6.6%, 1.2%, and 0.6%, respectively. In terms of vulnerability localization performance, the present invention improves AD to an accuracy of 0.78 lines (since other methods do not have vulnerability localization capabilities, this column is described as "N / A"). In terms of VL, the present invention achieves an average of 1.0 vulnerability output lines, an average improvement of 4.2 lines over existing methods.

[0078] Table 1

[0079]

[0080] The specific embodiments described herein are intended to illustrate the principles of the present invention. Persons skilled in the art, informed by the present invention, may make various modifications, additions, or substitutions to the described specific embodiments, all of which fall within the scope of protection of the present invention. The scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A vulnerability location method based on assembly language and deep learning, characterized in that: The following steps are involved: Step A: compile the source code into target code, use GDB to disassemble the target code, obtain the assembly code containing address information, and further obtain the assembly code containing source code line numbers, then obtain all debuggable functions in the target code, slice each complete assembly code in units of functions, and obtain multiple code blocks, where the source code includes all training samples and test samples; Step B: Mark the code block: query the description file provided by the training sample dataset. If the code block contains a known vulnerability, mark it as 1, otherwise mark it as 0; Step C: Encode the training sample code block into a vector and input it into the established neural network model for training. The neural network model is a BILSTM-LOC model, which includes an input layer, a standard BILSTM layer, and a positioning layer; The specific structure of the BILSTM-LOC model in step C is as follows: Step C1, input layer: Before inputting into the neural network model, each labeled code block is encoded into a vector and then the vector length is unified. The length of the vector input to the neural network is set to δ, where δ is the length of the code block. If the vector length is less than δ, it is padded with 0 at the end. If the vector length is greater than δ, the part greater than δ is trimmed from the end. Each token is encoded as a vector of length θ and each code block is encoded as a vector of length "δ×θ×β", where θ is the length of the vector obtained after encoding each token and β represents the maximum number of assembly instructions per line. Step C2, Standard BILSTM Layer: The encoded fixed-length vector is input into the standard BILSTM layer for learning vulnerability features. The standard BILSTM layer consists of two standard BILSTM layers, a dropout layer, a fully connected layer, and an activation layer. The dropout layer is used to prevent overfitting of the neural network, while the fully connected layer and activation layer are used to obtain prediction results. Step C3, positioning layer: The output of BILSTM corresponding to a batch-sized code block of input is expressed as: y=[γ1 γ2…γ μ-1 c μ ] T (1) The value range of μ is 1≤μ≤batchsize, where batchsize represents the batch size; γ μ Expressed as: Refers to the output corresponding to each line of assembly instructions in a code block, and δ represents the length of the code block. To make nodes with vulnerabilities receive more attention, the output of BILSTM is multiplied by the 01Matrix, denoted as M, which is used to retain the information of nodes with vulnerabilities while removing the information of nodes not related to the vulnerability. M can be expressed as: where m μ,δ Calculate according to the following principle: The source code line number corresponding to the known code block is represented as a set Cb μ ={l1,l2…l n }, 1≤n≤δ, δ represents the length of the code block; the real vulnerability line number is known to be v, for the code block with the vulnerability l n =v, let m μn =1, otherwise set m μn =0; for code blocks without vulnerabilities, set m μn =1; After obtaining the matrix M, it is multiplied by the output of BILSTM. Then, the K-max pooling layer is used to select the top k largest values of the output corresponding to each code block, that is, the top k most important information predicted by the neural network. These k largest values are input into the global average pooling layer to calculate the average value and obtain the output ω, which is defined as: ω=Average(Max k (γ μ M))=(t1,t2…t μ-1 ,t μ ) (4) Function Max k Calculate the k maximum values of the predicted value, and the function Average is used to calculate the average of the k maximum values, t μ Indicates the output corresponding to each code block; In step D, the trained BILSTM-LOC model is used to detect and locate vulnerabilities in test samples during the testing phase.

2. The vulnerability location method based on assembly language and deep learning according to claim 1, characterized in that: The specific implementation method of obtaining the assembly code containing the source code line number in step A is as follows; Step A1: compile all source codes, i.e., all training samples and test samples into target codes through GCC, and select all successfully compiled programs; Step A2, disassembly, uses the GDB tool to debug the target code to obtain the assembly code with the address, and uses the Addr2line tool to convert the address into the line number of the source code, thereby obtaining the assembly code including the line number of the source code.

3. The vulnerability localization method based on assembly language and deep learning according to claim 1, characterized in that: Each code block in step A consists of two parts: assembly instructions and the source code line number corresponding to each line of assembly instructions. Each line of assembly instructions consists of multiple tokens.

4. The vulnerability localization method based on assembly language and deep learning according to claim 1, characterized in that: The specific implementation of step D is as follows: Step D1: Encode the code blocks in the test set into vectors. Each code block is encoded as a vector of length δ×θ×β. Step D2: The vector obtained after encoding each code block is input into the trained BILSTM-LOC model to obtain the output of each line of assembly code. First, the k maximum values of the output are calculated, and then the average of the k maximum values is calculated. If the average value is greater than the threshold σ, the code block with the vulnerability and the assembly code corresponding to its k maximum values are output. The line number before the assembly code is mapped to the line of the source code, and finally the vulnerable line number of the source code is obtained. Step D3: The output value corresponding to each line of assembly code ranges from 0 to 1.

0. The closer the output is to 1.0, the higher the possibility that there is a vulnerability in the line of assembly code.

Images